Retrieve Azure Key Vault Key & Secret in ASP.NET Core Web API

In my previous articles, I explained how to retrieve Azure Key Vault keys and secrets in C# and .NET applications using DefaultAzureCredential, with practical code examples. In this article, we will explore how to retrieve Azure Key Vault keys and secrets in ASP.NET Core using Managed Identity.

Managed Identity is an Azure feature that allows applications running on supported Azure services to authenticate to Azure resources without storing client secrets, passwords, or other credentials in application code or configuration files. By combining Managed Identity with the Azure SDK libraries, such as Azure.Security.KeyVault.Keys and Azure.Security.KeyVault.Secrets, we can securely access keys and secrets from Azure Key Vault.

Throughout this article, we will learn how to enable Managed Identity, assign the required permissions to access Azure Key Vault, configure authentication in an ASP.NET Core application, and retrieve both keys and secrets using practical C# examples.

By the end of this guide, you will understand how to integrate Azure Key Vault with an ASP.NET Core application using Managed Identity and implement a more secure approach to managing sensitive application data.

Prerequisites

Before retrieving Azure Key Vault keys and secrets in an ASP.NET Core application using Managed Identity, make sure you have the following prerequisites:

An active Azure subscription: You need an Azure subscription to create and configure Azure resources.
An Azure Key Vault: Create an Azure Key Vault containing at least one cryptographic key and one secret that you want to retrieve.
An ASP.NET Core project: Create an ASP.NET Core Web API or another ASP.NET Core application using a supported version of .NET.
Managed Identity enabled: Enable a system-assigned or user-assigned Managed Identity on the Azure service hosting your application, such as Azure App Service or Azure Virtual Machines.
Required Azure Key Vault permissions: Assign the appropriate Azure role-based access control (RBAC) permissions to the Managed Identity. For example, use Key Vault Crypto User for cryptographic key operations when required, and Key Vault Secrets User to read secret values. The exact permissions depend on the operations your application performs.
Required NuGet packages: Install the following packages to authenticate with Azure and access keys and secrets from Azure Key Vault:
- Azure.Identity — provides authentication support, including ManagedIdentityCredential and DefaultAzureCredential.
- Azure.Security.KeyVault.Keys — provides client classes for accessing and managing cryptographic keys.
- Azure.Security.KeyVault.Secrets — provides client classes for accessing and managing secrets.
Azure Key Vault URL: Obtain your vault endpoint, such as https://your-vault-name.vault.azure.net/, which will be used to initialize the Key Vault clients.

Note: Managed Identity works when your application runs in an Azure environment that supports it. For local development, you can use a developer credential or another appropriate authentication method. Enabling Managed Identity alone does not grant access to Key Vault; the identity must also have the required permissions.

Install the Required NuGet Packages

To retrieve Azure Key Vault keys and secrets in an ASP.NET Core application using Managed Identity, we need to install the following NuGet packages:

Azure.Identity: Provides authentication support for Azure services, including ManagedIdentityCredential and DefaultAzureCredential.
Azure.Security.KeyVault.Keys: Provides the KeyClient class for accessing Azure Key Vault keys.
Azure.Security.KeyVault.Secrets: Provides the SecretClient class for accessing Azure Key Vault secrets.

After installing these packages, your ASP.NET Core application will have the required libraries to authenticate with Azure and retrieve keys and secrets from Azure Key Vault.

Technical note: For an Azure-hosted application, you can use ManagedIdentityCredential to explicitly authenticate with Managed Identity. If you use DefaultAzureCredential, it can select Managed Identity in Azure while also supporting developer credentials during local development.

Configure Azure Managed Identity in Azure Portal

Before retrieving Azure Key Vault keys and secrets in your ASP.NET Core application, complete the following steps in the Azure portal:

Enable Managed Identity: Enable a system-assigned or user-assigned Managed Identity for the Azure service hosting your ASP.NET Core application, such as Azure App Service or Azure Virtual Machines.
Assign the required permissions: Open your Azure Key Vault and grant the Managed Identity the appropriate permissions to access keys and secrets. If your vault uses Azure role-based access control (RBAC), assign the following roles as required:
- Key Vault Crypto User: Allows permitted cryptographic operations on keys. For retrieving key metadata, use a role that grants the required read permissions, such as Key Vault Reader.
- Key Vault Secrets User: Allows reading secret values from the vault.
Obtain the Key Vault URI: Copy your Azure Key Vault endpoint, for example, https://your-vault-name.vault.azure.net/. This URI will be used to initialize the KeyClient and SecretClient objects.
Create a cryptographic key: Ensure that at least one key exists in Azure Key Vault and note its name. You will use this name to retrieve the key information in your ASP.NET Core application.
Create a secret: Add at least one secret to Azure Key Vault, such as a sample application setting or connection string, and note its name. You will use this name to retrieve the secret value.

Note: The exact permissions depend on the operations your application performs and the permission model configured for your vault. If your vault uses the legacy access policy model instead of Azure RBAC, configure the appropriate key and secret permissions in the vault's access policies. Managed Identity authenticates your application, but you must grant it the necessary permissions separately.

Configure Managed Identity Authentication

In the following sections, we will configure Managed Identity authentication and use the KeyClient and SecretClient classes to access Azure Key Vault resources.

Configure the Key Vault settings for Key

</> JSON
	{
      "KeyVault": {
        "VaultUri": "https://your-vault-name.vault.azure.net/",
        "KeyName": "my-encryption-key"
      }
}

Add the above settings to appsettings.json. Replace your-vault-name and my-encryption-key with your actual Key Vault name and key name.

Apply the same steps to your Key Vault Secret. You can refer to my previous article for guidance if needed.

Configure Managed Identity in Application and

Update Program.cs with the following code:

</> C#
using Azure.Identity;
using Azure.Security.KeyVault.Keys;
using Azure.Security.KeyVault.Secrets;
var builder = WebApplication.CreateBuilder(args);
// Read Key Vault configuration
string vaultUri = builder.Configuration["KeyVault:VaultUri"]
?? throw new InvalidOperationException(
"Key Vault URI is not configured.");
string keyName = builder.Configuration["KeyVault:KeyName"]
?? throw new InvalidOperationException(
"Key Vault key name is not configured.");
string secretName = builder.Configuration["KeyVault:SecretName"]
?? throw new InvalidOperationException(
"Key Vault secret name is not configured.");
// Configure Managed Identity authentication
var credential = new ManagedIdentityCredential();
// Initialize Key Vault clients
var keyClient = new KeyClient(
new Uri(vaultUri), credential);
var secretClient = new SecretClient(
new Uri(vaultUri), credential);
// Register clients with dependency injection
builder.Services.AddSingleton(keyClient);
builder.Services.AddSingleton(secretClient);
var app = builder.Build();
// Retrieve key information
app.MapGet("/key", async (KeyClient client) =>
{
  var response = await client.GetKeyAsync(keyName);
  var key = response.Value;
  return Results.Ok(new
  {
    KeyName = key.Name,
    KeyId = key.Properties.Id,
    Enabled = key.Properties.Enabled,
    CreatedOn = key.Properties.CreatedOn
    });
    });
    // Retrieve a secret value
    app.MapGet("/secret", async (SecretClient client) =>
    {
      var response = await client.GetSecretAsync(secretName);
      var secret = response.Value;
      return Results.Ok(new
      {
        SecretName = secret.Name,
        SecretValue = secret.Value,
        Enabled = secret.Properties.Enabled,
        CreatedOn = secret.Properties.CreatedOn
        });
        });
        app.Run();

Understand the implementation

Managed Identity authentication: ManagedIdentityCredential obtains an access token using the Managed Identity assigned to your Azure-hosted application.
KeyClient: The KeyClient instance retrieves an existing cryptographic key and its properties using GetKeyAsync().
SecretClient: The SecretClient instance retrieves a secret and its value using GetSecretAsync().
Dependency injection: Both clients are registered as singletons so they can be injected into the API endpoints.
API endpoints: The /key endpoint returns key metadata, while /secret retrieves the secret value.

Test the API

Once your application is deployed to an Azure service with Managed Identity enabled, call these endpoints:

HTTP method: GET
- Endpoint: /key
- Purpose: Retrieves key information.
HTTP method: GET
- Endpoint: /secret
- Purpose: Retrieves the secret value.

For example, the /key endpoint returns a response similar to:

</> JSON
{
  "keyName": "my-encryption-key",
  "keyId": "https://your-vault-name.vault.azure.net/keys/my-encryption-key/abc123",
  "enabled": true,
  "createdOn": "2026-10-20T10:30:00+00:00"
}

The /secret endpoint returns a response similar to:

</> JSON
{
  "secretName": "DatabaseConnectionString",
  "secretValue": "your-example-secret-value",
  "enabled": true,
  "createdOn": "2026-10-20T10:30:00+00:00"
}

Security note: Do not expose secret values through an unauthenticated API endpoint in a production application. The /secret endpoint is intended to demonstrate retrieval; protect it with appropriate API authorization and avoid returning secrets to clients unless absolutely necessary. ManagedIdentityCredential also requires a supported Azure hosting environment with Managed Identity enabled. For a user-assigned identity, specify its client ID when creating the credential.

Summary

In this article, we learned how to retrieve Azure Key Vault keys and secrets in an ASP.NET Core application using Managed Identity. We configured Managed Identity authentication using ManagedIdentityCredential and used the KeyClient and SecretClient classes from the Azure SDK libraries to access key information and secret values securely.

We also explored how to configure the Key Vault URI and resource names, register the clients using dependency injection, and expose API endpoints to retrieve keys and secrets. By assigning the appropriate permissions to the Managed Identity, an ASP.NET Core application can access Azure Key Vault without storing client secrets or credentials in application code.

Managed Identity provides a convenient and secure way to authenticate applications running on supported Azure services. When combined with Azure Key Vault and the Azure SDK, it helps simplify credential management and improve application security.

If you have followed my previous articles on retrieving Azure Key Vault keys and secrets using DefaultAzureCredential, this approach provides an alternative for applications that specifically use Managed Identity for authentication.

By applying these techniques, you can integrate Azure Key Vault into your ASP.NET Core applications and manage sensitive application data more securely.

Thanks